THE INTEGRATED RISK MANAGEMENT PROCESS
The process of estimating the risks of a facility, judging its safety both technically and
from a social analysis, and developing risk control measures if required, comprise the
integrated risk management process. The steps in the risk management process are
shown in flow chart form in Figure 1.
System description consists of understanding the components of the facility and how it
operates, establishing an inventory of hazardous substances used, transported, and
manufactured, and being familiar with the surrounding area that might be affected by
hazardous events in the facility, in terms of population, land-use, and climate, etc.
Examples of hazardous facilities are chemical plants, refineries, and transportation
corridors such as rail corridors, pipelines or waterways where dangerous goods are
Other important components of the system that must be understood by the risk assessors
and decision-makers include the applicable health, safety, and environmental laws and
regulations, and the values of the stakeholders. The latter can only be accomplished by
early involvement of the stakeholders in the decision-making process.
Hazard identification answers the question: What can go wrong? Potentially hazardous
events are identified and defined in this step. For example, the realization that a car while
crossing a street can hit one, and that one could die or become injured as a result of this
accident constitutes the hazard identification step.
Public Analysis Industry / Technical
Community Risk Analysis
Interest Groups 1. Hazard identification
local government 2a. Consequence Analysis
employees/management 2b. Frequency analysis
Risk Communication 3Risk estimation
Distribution of Operations &
Benefits & Risks Maintenance
Risk Evaluation Yes
(is risk acceptable)
Public Policy &
Before risk can be managed, it must be understood. Risk analysis helps to understand the
risk of a hazardous facility and the reductions in risk achievable given certain risk control
measures. It answers the following questions for the identified events: How often is the
event expected to occur? (frequency analysis) and, if it occurs, What are the
consequences of the event? (consequence analysis).
Frequency analysis makes use of historical accident data in similar facilities. Fault and
event trees are also commonly used in frequency analysis to assist in keeping track of
cause-effect relationships, and system and material behavior characteristics.
Consequence analysis consists of modeling the behavior of releases of hazardous
substances, and their impact on critical receptors making use of dose/response
(vulnerability) data and models.
Risk estimation is the process by which the frequencies and consequences of events are
combined to quantify risk. The results of risk analysis are used extensively in risk
management decisions throughout the world.
The uncertainties in estimating the likelihood of rare events, and in projecting the effects
on human populations, are considerable. However, high uncertainty does not mean high
risk. Typically, conservative assumptions are made to avoid underestimation of risk.
Estimation of uncertainties in risk estimates is currently an area of active research.
Public Analysis and the importance of stakeholder participation in the risk management
process cannot be overemphasized. Identification of the stakeholders in any given
situation, communication of the risks to employees, the public, and other stakeholders
exposed to these risks, and their participation in understanding the risk and commenting
on risk control measures, are essential to ensure buy-in from the stakeholders regarding
the acceptability of the risks and risk control measures that would be implemented.
(More detailed guidance on how to identify the relevant stakeholders, understand their
needs, and how to ensure their participation in the decision-making process can be found
in the Risk Communication literature referenced in the Resources page of this web site.)
Risk evaluation answers the questions: Is the risk judged to be acceptable?, and, Do we
need to do anything about it? Whether we judge risk to be small or large, acceptable or
unacceptable depends on many factors. A hazardous facility is often seen as posing an
involuntary risk on someone living nearby (especially if the facility is built after the
person starts living there) but it might be seen as a voluntary risk if someone chooses to
live near an existing facility provided that the person is aware of the risks before moving
there. Risk acceptability criteria are generally designed for cases of involuntary risk
resulting from hazardous facilities. They are intended to be used as public safety
The combined process of risk analysis and risk evaluation is usually called risk
If the risks are judged to be technically and socially acceptable, then further risk control
measures, or system changes, will not be required. However, it is then essential to
develop programs to monitor the situation so that it does not deteriorate over a period of
time. Safety audits are among the tools used for this purpose.
If it is judged that further safety improvements are required, risk control options
introducing system modifications need to be examined.
Risk control answers the question: What can be done to reduce the risks if we need to?
Decreasing the likelihood and/or consequences of hazardous events can reduce risk. Risk
control measures can be broadly classified into:
Safety management of the hazardous facility; this includes process safety
management practices, such as technological measures (e.g., design changes and
inventory reduction) and management measures (e.g., auditing, inspection,
maintenance, training and work practices),
Incident management, such as emergency response, emergency response plans
and exercises, and
The company operating the hazardous facility can generally only take the “facility safety
management” type of risk control measures. In our context of major industrial accidents,
process safety management is probably the most important component of “facility safety
management”. Municipal fire departments or hazardous materials teams in co-operation
generally address incident management issues with the operators of the facility. The third
type of risk control measures is addressed by municipal planners, often in consultation
with all stakeholders, including operators of the hazardous facilities.
Risk control measures will have certain costs associated with them. By estimating the
risk reduction possible for each option, it is possible to assess the costs and benefits for
each option, and informed decisions on which option should be selected can be made on
Other options that can be used to alter the risk evaluation or acceptable level of risk
related to an activity include:
Redistribution of benefits and risk. This is an alternative that is determined during
the Social Analysis portion of the Risk Assessment process. Individuals or
communities and other stakeholders may opt for some form of benefit to make the
risk acceptable. Sometimes this may relate to removing any disbenefits
(emissions, traffic, facility proliferation, etc.).
Changes to public policy and regulation are decisions that are made that address
risk issues directly as a way of adding regulatory oversight to their management.
Uncertainty in risk estimates. Risk analysis results are derived from the processing of
large quantities of information obtained from numerous scientific fields. Some of these
can be highly subjective, incorporating numerous assumptions. In addition, they are
based on limited and “imperfect” data. There are many uncertainties in the process.
These can be described as:
Input data uncertainties
Uncertainties pertaining to the degree of detail-more detail requires more effort
and therefore greater cost
Uncertainties pertaining to the analyst(s)-lack of experience or lack of knowledge
in one or more areas of the risk analysis
Typically, conservative assumptions are made to reduce the level of effort required and to
err on the safe side (i.e., have confidence that risk is overestimated). However, if
uncertainties are too large, the results of the analysis may be meaningless. The best risk
analysis are those that yield results from which meaningful conclusions can be drawn, but
completed for the lowest possible cost. These studies require a comprehensive
understanding of the factors that affect the results and the strategic use of realistically
Reference: Major Industrial Accident Council of Canada Risk Management Guidelines.